CVE-2026-86743

Publié : 9 septembre 2026

Modifié : 9 septembre 2026

Score CVSS

MEDIUM

Description détaillée

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Références et Patchs

https://github.com/grokability/snipe-it/security/advisories/GHSA-7xrr-xm47-rc6w https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-asset-acceptance-report https://github.com/grokability/snipe-it/security/advisories/GHSA-7xrr-xm47-rc6w

Dernières Vulnérabilités

CVE-2026-82563

An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmware-update behavior.

VOIR DÉTAILS

CVE-2026-81640

An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality.

VOIR DÉTAILS

CVE-2026-81330

The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption.

VOIR DÉTAILS